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Age appropriate design: an ICO code of 
practice for online services. 
Consultation response from DMG Media 


1. This response to the ICO’s Age appropriate design consultation is made on behalf of 
DMG Media, publishers of the Daily Mail, Mail on Sunday, MailOnline, Metro and 
Metro.co.uk, and the largest commercial publisher of news online in the UK. 


Executive Summary 


2. The draft Code poses an existential threat to every news website in Britain, apart 
from the BBC. 


3. No one would argue with its purpose, which is to ensure children are not encouraged 
to share information which would make them vulnerable to stalking, abuse, 
bullying, or commercial exploitation. 


4. However the scope of this Code has been drawn far too widely. It specifically 
includes news websites and demands that cookies — which all commercial news 
sites use to sell advertising - are switched off by default. 


5. This would mean we are unable to sell any advertising unless we erect an age wall to exclude 
children. But no one is going to give passport or driving licence details to a website, and log 
in every time they visit, in order to read news which will still be freely available on the BBC 
website - not covered by the Code because it sells no advertising. 


6. Without wishing to be melodramatic, this will cause the collapse of the online news industry. 
DMG Media’s digital arm employs almost 500 people in the UK, and nearly 350 more in the 
US and Australia, all jobs created in the last decade. Those jobs will go, as will thousands 
more at other news websites. And as advertising shifts remorselessly online, thousands 
more jobs will be at risk on print titles that will not be viable without a digital presence. 


10. 


11. 


12. 


13. 


. In an age of growing concern over fake news and disinformation, when the public 


tire of the BBC the only news on their smartphones will come from rumour- 
mongers, conspiracy theorists, services funded by foreign governments, like Russia 
Today, or from US rivals who will be able to use their US profits to take over UK 
news. It is hard to see how that would help children. 


. Perversely, the organisations that would find it easiest to impose an age-wall, 


because of the functional services they offer, would be the US internet giants 
Facebook and Google. Thus the children’s code would only cement the digital 
domination of the companies held most responsible for spreading online harms. 


. The evidence base for the ICO’s Code is alarmingly slim — no more than a set of focus 


groups and opinion polls of children and parents/carers. The research document 
makes clear the answers supplied by children cannot be relied on at all. Nor does 
the Code show any evidence — unreliable or otherwise - that children have been 
harmed by using news websites. 


This is not surprising. In common with other news websites we do not carry content 
aimed at children, nor do we target advertising at children. The youngest market 
segment we offer to programmatic advertisers is 18-24. All our advertising complies 
with the Code of Advertising Practice, which specifically protects children, and is 
regulated by the Advertising Standards Authority. 


Yet, bizarrely, the Code does not apply to broadcast television, which includes 
programming specifically aimed at children, funded by advertising which also 
targets children. What is the logic of this? 


The Code contains no reference to the European Convention on Human Rights. This 
is an extraordinary omission. The Information Commissioner must be aware that 
both the Data Protection Act 2018 and any Code stemming from it must comply 
with the Convention. As the Code specifically covers news websites that means it 
must meet the requirements of ECHR Article 10, which guarantees the public’s 
fundamental right to receive information and the news media’s right to impart it. By 
denying the news media the means to fund its journalism the Code is clearly in 
breach of Article 10 and therefore legally unsound. 


In a final irony the Code claims to be based on the United Nations Convention on 
the Rights of the Child. This includes the ‘right to seek, receive and impart 
information and ideas of all kinds... in writing or in print, in the form of art, or 
through any other media of the child’s choice’. Destroying the British online news 
industry is hardly the way to secure that right. 


14. As drafted the Code will have disastrous consequences, not just for our industry and 
its employees, but for society at large. 


15. The Code must be redrafted: 
e toinclude a specific and total exemption for news publishers, and 


e to make clear that profiling for the purpose of delivering advertising which 
meets the standards of the Code of Advertising Practice is not detrimental to 
children’s health and well-being and is therefore permitted under the Code. 


e To ensure compliance with ECHR Article 10. 


Evidential basis for the Code 


16. We understand that devising this Code is an obligation placed on the ICO by the 
Data Protection Act 2018, which in turn was an obligation placed on Parliament by 
the EU General Data Protection Regulation. 


17. The DPA is actually even vaguer than the recital 38 of the GDPR, which it imports 
into British law. Recital 38 says: 


Children merit specific protection with regard to their personal data, as they 
may be less aware of the risks, consequences and safeguards concerned and 
their rights in relation to the processing of personal data. 


Such specific protection should, in particular, apply to the use of personal 
data of children for the purposes of marketing or creating personality or user 
profiles and the collection of personal data with regard to children when 
using services offered directly to a child. 


18. The DPA translates that as: 


The Commissioner must prepare a code of practice which contains such 
guidance as the Commissioner considers appropriate on standards of 
age appropriate design of relevant information society services which are 
likely to be accessed by children’ 


The DPA widens the boundaries from ‘services offered directly to a child’ to 
‘services which are likely to be accessed by children’. At the same time it 
gives the ICO enormous latitude: ‘The Commissioner must prepare a code of 


practice which contains such guidance as the Commissioner considers 
appropriate [our emphasis]’” 


19. In other words, the DPA requires the Commissioner to work across a very broad 
landscape, but gives her a free hand to decide what guidance is appropriate and to 
whom it should apply. 


20. We find it puzzling, therefore, that the ICO seem to have conducted so little 
research to discover where the harms they are required to address take place, and 
what might be the economic and social effects of the restrictions they propose. 


21. ‘Towards a better digital future’, the research released with the draft Code, is flimsy 
in the extreme. It is based entirely on opinion polls and focus groups. Anyone who 
observed the last two general elections and the EU referendum could have warned 
the ICO about the danger of relying on which boxes people tick in opinion polls. 


22. Relying on what children say in focus groups is even more questionable. Revealing 
Reality, the company which carried out the research, issue very clear health 
warnings. They make interesting reading: 


= This research did not examine children’s actual behaviour, so we are 
reporting on what they say rather than what they do 


= Children were interviewed in groups, in which they may have tended 
to agree with what others were saying rather than stating their own 
opinion 


= Children were interviewed in school and often repeated things that 
their teachers/parents had told them, which they knew to be the 
‘right’ answer, but may not have necessarily done or believed 


= Children tend not to have a clear world view, which meant that there 
could be a different response depending on how the question was 
asked. As a result, there were often contradictions in what children 
were saying, depending on the framing of the question? 


23. It seems pretty clear that it would be unwise to base any Code of Practice on this 
research, let alone a Code which has the potential to threaten the future of entire 
sectors of industry. 


1 Age appropriate design p.7-8 
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24. But even if we suppose the research does paint an accurate picture of children’s 
online experience and concerns, it does not justify some of the draconian measures 
proposed in the Code. 


25. The research found that children are rightly concerned about compromising their 
physical safety online. They are very wary about the danger of sharing online 
personal data which would identify them as individuals, in particular their home 
address. 


26. Their views on the use of cookies and targeted advertising are much more nuanced. 
True, some children said they didn’t like advertising, saying it made them feel used — 
an opinion shared by many adults — but at the same time they recognised that 
without advertising services they valued could not be funded: 


“Sometimes | feel a bit used for my money, but | know companies might need 
them to survive” 13—15-year old, Swansea 


“Well that’s how they make money — the internet’s free so they have to find 
some way” 13-15-year old, Edinburgh? 


27. Interestingly most children preferred targeting advertising, because it was tailored 
to their interests: 


“children also tended to perceive targeted advertising more positively when 
the researchers positioned the idea in opposition to ‘random’, unpersonalised 
advertising; when children were presented with the scenario of having to 
choose between the two, most preferred to see content that was relevant to 
their interests. Personal recommendations for further online content (such as 
music or videos) was also widely considered to be a good thing among older 
age-groups.”* 


28. We refer to these research findings not because selling advertising targeted at 
children is a significant element of our news websites’ business model. It isn’t. But 
what they show is that whereas there may be a fair case for draconian measures to 
prevent children revealing online data which would threaten their physical safety, 
the case for applying the same measures to prevent even the possibility of exposure 
to advertising tailored to their interests is far weaker — and must be balanced 
against the hugely damaging economic and social consequences of effectively 
banning targeted advertising. 


3 Ibid p.23,41 
4 Towards a better digital future p.42 


Services covered by the Code 


29. As we made clear at paragraphs 16-17, the DPA gives the Information Commissioner 
enormous latitude in deciding the scope of this Code, and the ICO appears to have 
decided to apply it as broadly as possible. There is no attempt to restrict it to 
services where children might be expected to encounter online hazards, such as 
social media platforms, messaging, video streaming, or gaming services. 


30. Instead every form of commercial activity on the internet appears to be included, 
whether it involves the direct sale of goods or services, or is a free service which is 
funded by advertising. 


31. Definitions are unhelpfully vague. ‘The Code applies if children are likely to use your 
service’. But the meaning of ‘likely’ is not defined. Instead businesses are told they 
must conduct market research to find out whether children are likely to use their 
services. Even if a business is aimed squarely at adults it is not safe, because 
children might use it: 


The important point is that even if the service is aimed at adults, you must be 
able to point to specific documented evidence to demonstrate that children 
are not likely to access the service in practice. 


If you initially judge that the service is not likely to be accessed by children, 
but evidence later emerges that a significant number of children are in fact 
accessing your service — even if this is only a small proportion of your overall 
user base - you need to comply with the code.” 


32. Online retailers such as Tesco or Marks & Spencer generally sell to adults, but they 
also stock items such as clothing specifically aimed at children and teenagers, and 
electronic goods which will appeal to them. Banks routinely offer debit cards to 
children as young as 11, so there can be no doubt children have the means to buy 
these goods online. Will they and their competitors be covered by the Code? Faced 
with fines of 20m Euro or 4p.c. of turnover if they are found in breach, they will 
have to assume they are. 


33. The Code is equally unhelpful to small businesses: 
If you are a small business with a website, your website will only be an ISS 
[information society service] if you sell your products online, or offer a 


type of service which is transacted solely or mainly via your website without 
you needing to spend time with the customer in person. 


> Age appropriate design p.14 


If you are uncertain whether your service is an ISS or not then we recommend 
you take your own legal advice. 


Very few small businesses can expect to succeed these days without an online 
presence. How many can afford legal advice and market research to establish they 
are not covered by this Code? Again, faced with the prospect of draconian fines, they 
will have to assume they are. They then face the additional burden of carry out a 
Data Protection Impact Assessment: 


We will expect you to do some form of consultation in most cases. For 
example, you could choose to get feedback from existing users, carry out a 
general public consultation, conduct market research, conduct user testing, or 
contact relevant children’s rights groups for their views.® 


How many small businesses and start-ups will have the resources to carry out a 
public consultation and debate with children’s rights groups? 


34. As far as news websites like ours are concerned, we are left in no doubt: ‘news and 
education websites’ are specifically included. Why? We do not publish any content 
specifically aimed at children, nor directly sell any advertising targeting them — the 
youngest demographic segment we offer advertisers is 18-24. 


35. Clearly children under 18 can access our website if they wish to. This is their right 
under the United Nations Convention on the Rights of the Child, which forms part of 
the basis for the Code: 


The child shall have the right to freedom of expression; this right shall include 
freedom to seek, receive and impart information and ideas of all kinds, 
regardless of frontiers, either orally, in writing or in print, in the form of art, or 
through any other media of the child’s choice [our emphasis].’ 


36. Although we do not publish any content specifically aimed at children, Comscore 
figures show that 5.3 per cent of our users are under 18. Is 5.3 per cent a ‘significant 
number’ under the Code? Presumably, as news websites are specifically covered, 
the ICO believes it is, which should be a warning to other businesses with an online 
presence. 


37. However, bizarrely, one class of publisher which does offer content which 
specifically targets children, and funds it with advertising also targeted at children, is 
exempt. Broadcasters are not covered even if their service is supplied over the 
internet, so long as they are broadcast to a general audience rather than at the 


5 Ibid p.85 
7 United Nations Convention on the Rights of the Child, Article 13 
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request of an individual. MailOnline also supplies news to a general audience over 
the internet, sometimes with the same video content as broadcast television. What 
is the difference between an individual using a computer to access ITV News and to 
access MailOnline? There is no explanation. 


Profiling 


38. 


39. 


40. 


41. 


42. 


43. 


Profiling — by which we assume the draft Code means the use of cookies — is at the 
core of any commercial news website’s business model. No news website in the UK, 
apart from the FT, which occupies a unique niche market, has been able to build a 
sustainable business on the basis of subscriptions. News UK had to abandon 
subscriptions for the Sun, and while The Times, which retains a paywall, reported 
just £9.6m profit last year, that was based on print as well as digital revenue. 


Paywalls have not been made to work for mass market news websites - MailOnline 
and Metro.co.uk are both free-to-air, and 100 per cent of their revenues come from 
advertising. Both are currently profitable. 


Cookies are essential to selling advertising online. The vast majority of online 
advertising is sold programmatically: when a user opens a web page a digital auction 
takes place, and by the time the page loads the user’s cookies, which infer his/her 
demographics and interests from their browsing history, have been matched to 
advertisers wishing to reach that market segment. In a space of milliseconds a 
digital auction takes place in which they bid to serve their ads on that user’s page. 


There is nothing sinister about this. It is the digital equivalent of a market stall- 
holder looking a customer up and down, and on the basis of his/her knowledge of 
past sales, offering the fruit and veg which appears most suited to that particular 
customer’s means and tastes. 


The information we supply to advertisers is all anonymised: there is nothing to 
identify individuals, only demographic groups. Geolocation on our websites is 
extremely broad; it goes no deeper than delivering groups of users who live in a 
county or city. It certainly doesn’t provide addresses, postcodes or GPS co- 
ordinates. 


The same applies to nudge techniques. Like virtually all news websites we use 
continuously scrolling pages, but only to suggest other stories the user might like to 
read. This is no different to the techniques newspapers have used for more than 
100 years — puffs, blurbs and cross-references that draw the reader into the 
newspaper to ensure they get a chance to sample everything which is on offer. 
Notifications are used to inform regular users when a big story breaks, just as 


44. 


45. 


46. 


47. 


48. 


49. 


50. 


newspapers have always used billboards. In fact notifications are less intrusive 
because users have to opt in to receive them. 


Not only do children have a right to know what is going on in the world, it is part of 
their education. It would be very hard to argue that drawing children’s attention to 
news stories damages their health or well-being. No one has ever suggested 
newspapers should not be sold to children. 


Lord Leverhulme, the founder of Unilever, famously (and probably apocryphally) 
once said: ‘Half the money | spend on advertising is wasted, the trouble is | don’t 
know which half’. Cookies solve that problem, bringing down the cost of products to 
the advertiser and consumer alike. Therefore even advertisers who do not use the 
programmatic route, but buy their ads with us direct, still want to use cookies to 
ensure their message is reaching the right audience. 


GDPR has forced us to test this. The vast majority of users happily accept the use of 
cookies. However some don’t, which means we can’t sell them targeted advertising. 
Instead we sell ads based on the content of the pages they choose to read — so 
when they read a page about motoring they see ads for cars, as you might in a 
newspaper. Ads sold this way typically yield just 15 per cent of the revenue received 
for the same ads sold via profiling by cookies. We could not possibly sustain our 
business if we were to lose 85 per cent of our ad revenue. 


As already explained, unlike TV broadcasters we do not publish content which is 
specifically aimed at children, nor do we sell children to advertisers as a market 
segment — the youngest demographic we offer is 18-24. Nevertheless we have two 
very popular websites, aimed at the broadest possible audience, and inevitably 
children will find content that interests them. 


If, as research shows, 5.3 per cent of our users are under the age of 18 it is possible, 
given that the programmatic process is opaque, that advertisers will reach 
audiences under the age of 18 by using our cookies to find users with an interest in 
products enjoyed by young people, such as music, clothes or electronic devices. 


The wording of the Code on this point is imprecise, perhaps deliberately so. We 
would therefore have to assume that the two tests it sets out - (a) ‘are our services 
likely to accessed by children under 18?’, and (b) ‘do a significant number of 
children access our service, even if it is only a small proportion of our user base?’ — 
would be met. 


Where the Code is in no doubt is that we must apply its standards to all children, 
which means applying it to all users — ‘unless you have robust age checks in place to 
distinguish children from adults’. 


51. This is spelled out very clearly: 


In practice, you can choose whether to apply the standards in this code to: 
e all users; 


eaill users by default, but offer robust age-verification mechanisms to 
allow adults who can prove their age to opt out of some or all of 
those safeguards; 


e only users who are children (and not to users who are adults), if you 
use robust age-verification mechanisms upfront to confirm the age 
of each user. 


We recommend that you give your users a choice over the use of age 
verification wherever possible. In other words, we recommend that 
you provide a child-appropriate service to all users by default, with the 
option of age-verification mechanisms to allow adults to opt out of the 
protections in this code and activate more privacy-intrusive options if 
they wish.® 


52. The ICO’s preferred option will not work for us. If we offer all our content without 
advertising, no one is going to prove their age by uploading personal data which 
could put themselves at risk — such as passport or driver’s licence details — just so 
they can see advertising. In any case the audience behind an age-wall would be so 
small it would not be viable for advertisers. 


53. Nor will the alternative option work. People wanting to access news will not be 
prepared to prove their age and log in every time they visit a commercial news 
website if they can find news without those restrictions on the BBC website, which 
as far we can establish will not be covered by the Code because it does not carry 
advertising. 


54. Either option would be catastrophic for our business. Our audience will disappear 
and so will our advertising. Without advertising revenue our websites would have to 
close — at the cost of almost 500 jobs here and nearly another 350 at our parallel 
websites in the USA and Australia. The same would apply to every other news 
website in the UK, with the possible exception of the FT and the Times, with the loss 
of thousands more jobs. 


8 Age appropriate design p23-24 
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° https: 


It would also strike a fatal blow to newspapers. The reason newspaper publishers 
have moved online is that print advertising is dying. Without the prospect of a 
digital future, newspapers will no longer be viable and the thousands more they 
employ will lose their jobs as well. 


This would be an appalling act of vandalism. Online news is a British digital success 
story — two of the ten largest news websites in the US (MailOnline and the 
Guardian) are British-owned. Our US operations, though growing fast, would be 
unsustainable without the solid base we have established in our home market. 


There would also be serious social and political consequences if this was to happen. 
The BBC is innately cautious and without commercial news publishers breaking 
controversial stories that engage public interest and currently provide much of the 
its news agenda, the BBC would relapse into a dull state broadcaster. The gap would 
be filled by news sources which do not rely on advertising — rumour-mongers, 
conspiracy theorists, and propaganda outlets funded by foreign powers or wealthy 
individuals. Large parts of the country would have no reliable news coverage at all. 
Disinformation would run riot, and children would be the most vulnerable. 


The Government is well aware of these risks, and has launched two major initiatives 
to try to address the problems of the news industry, struggling to maintain quality 
journalism in a digital marketplace dominated by two monopolistic tech giants, 
Google and Facebook. 


It would be extraordinarily counter-productive if all the good work being done 
through the Government’s Cairncross? and Furman? reviews were to be undone by 
the unintended consequences of an ill-considered digital intervention by another 
state agency — the ICO. 


And in a final irony it would also have the effect of preventing children from 
accessing the wide range of news sources available to them at present, in direct 
contravention of Article 13 of the UNCRC, on which the Code is supposed to be 
based, and Article 10 of the European Convention on Human Rights, which does not 
appear to have been considered at all. 


www.gov.uk/government/publications/the-cairncross-review-a-sustainable-future-for-journalism 


10 https://www.gov.uk/government/publications/unlocking-digital-competition-report-of-the-digital- 
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Age Verification 


61. Chapter 2 of the Code (Age-appropriate application) appears to make it clear that 
any website which is likely to accessed by children must be protected by age 
verification. 


62. However Chapter 11 (Profiling) introduces possible limits to this rule. The Code’s 
definition of profiling is wide-ranging: 


Profiling can be used for a wide range of purposes. It can be used extensively 
in an online context to suggest or feed content to users, to determine where, 
when and how frequently that content should be served, to encourage users 
towards particular behaviours, or to identify users as belonging to particular 
groups. 


Profiles are usually based upon a user’s past online activity or browsing 
history. They can be created using directly collected personal data or by 
drawing inferences (eg preferences or characteristics inferred from 
associations with other users or past online choices) 


63. It would seem clear this is intended to include advertising sold against data 
gathered by the use of cookies: 


Content feeds based upon profiling can include advertising content, content 
provided by other websites, downloads, content generated by other internet 
users, written, audio or visual content. Profiling may also be used to suggest 
other users to ‘connect with’ or ‘follow’? 


64. The Code then demands that features that rely on profiling are switched off by 
default unless there is a compelling reason to do otherwise, and explains: 


In practice it is likely to mean that any features that rely upon profiling and 
that you provide for commercial purposes are subject to a privacy setting 
which is switched off by default.?? 


65. This would seem to support the Code’s earlier insistence that cookies must be 
switched off by default, and therefore advertising cannot be presented except 
behind an age wall. However the Code goes on to say that if profiling is on there 
must be ‘appropriate measures in place to safeguard the child (in particular from 
inappropriate content)’ 


11 Age appropriate design p.61 
12 Ibid p.64 
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66. This is then explained: 


In practice this means that if you profile children in order to suggest content 
to them then you need suitable measures in place to make sure that children 
aren’t ‘fed’ or presented with content which is detrimental to their physical or 
mental health or wellbeing, taking into account their age.1? 


67. Types of content which may be detrimental to children’s health and well-being are 
listed. Top of the list is advertising content, but with a very important qualification: 


e advertising or marketing content that is contrary to CAP [Committee of 
Advertising Practice] guidelines on marketing to children. 


68. Does this mean that despite the apparently unequivocal requirement in Chapter 2 
that age verification is put in place, in fact it is possible to use profiling (cookies) and 
sell advertising, so long as any advertising meets CAP guidelines? 


69. The answer to that question is not clear, but CAP guidelines on advertising to 
children are very comprehensive — they run to 23 clauses — and the Advertising 
Standards Authority, which enforces the CAP, is one of Britain’s longest-standing 
and most-respected regulators. All advertising on MailOnline is regulated by the 
ASA and meets the standards of the CAP. 


70. It would seem perverse for the ICO to prevent the use of advertising which the ASA 
regards as perfectly suitable for children. This apparent contradiction needs to be 
resolved as a matter of urgency. 


European Convention on Human Rights 


71. The Information Commissioner will be aware that EU member states must comply 
with the European Convention on Human Rights [ECHR] when transposing 
community law into national law. This applies to the Data Protection Act 2018 and 
to the proposed draft Code, which must also comply with and be compatible with 
Convention rights and obligations. 


72. The European Court of Human Rights has recognised that any restriction upon 
Convention Rights, including the right to freedom of expression, must be 
“convincingly established and narrowly interpreted”. In consequence, any 
measures which will interfere with or restrict the right to receive or impart 
information must be: 


13 Age appropriate design p.65 
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73. 
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76. 


77. 


e prescribed by law; this includes a requirement that the restriction is not 
arbitrary, irrational or ineffective; 


e in pursuit of one or more particular legitimate aims; 
e ‘necessary in a democratic society’ - a response to a ‘pressing social need’, 


e and proportionate to the legitimate aim/s pursued. 


Thus, an assessment of proportionality will ask whether a less restrictive approach 
could have been pursued in any given circumstance. 


The regime proposed by this draft code is neither a legitimate, necessary, justifiable 
or proportionate interference with journalism (and news websites in particular), nor 
with the public’s right to receive information. It is incompatible with Article 10 of 
the ECHR. 


For the reasons developed in this submission, the profound consequences for the 
independent media of the measures in the proposed Code will interfere not only 
with a child’s Article 10 convention rights, but will also impact on the ability of 
everyone to access the widest possible range of information. The media’s central 
purpose is providing the public with information. This role is protected by law and 
benefits from wide ranging statutory and common law exemptions to protect the 
public’s right to information and the legal right to impart it. An economically viable 
media is essential for this purpose. 


Data Protection is a part of the law of privacy. It does not trump other convention 
rights. Freedom of expression and information is a fundamental right, against which 
the data protection rights of individuals must be appropriately balanced, 
importantly including those of children, even though their rights have been 
accorded ‘primacy’ by the UNCRC and GDPR. Data Protection rights apply to 
personal data, namely data which contains specific information which is related to 
an identifiable living person. If it does not, the data falls outside the data protection 
regime. 


It is extraordinary that the proposed Code fails to refer at any point to these 
Convention rights, a clear indication that they were not been taken into account 
when this draft was prepared. It is a clear failure for a Regulator to fail to observe a 
Convention as important and significant as the ECHR and so obviously to have failed 
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to reflect on the impact of its proposals on the vital public importance of a diverse 
and thriving media. This is a serious omission. 


The effect of this Code on our digital news publications, if promulgated as drafted, 
would be so catastrophic that we would have no option but to defend our 
Convention Rights in the courts, both here and in Strasbourg. 


Other unintended consequences 


79. 
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The companies which will find it easiest to persuade users to submit to age 
verification will be the tech giants: Google (which owns YouTube and Android), 
Facebook (which owns Instagram and WhatsApp), Amazon, Apple and Netflix. This is 
because they already have contractual relationships with users, and offer a range of 
functional services — email, social media, shopping etc, without which most people 
would find their day-to-day lives seriously disrupted. Disturbingly, in many cases 
these are also the companies most responsible for spreading online harms. 


This will give these big five players yet more dominant market power, to the 
detriment of smaller businesses and start-ups, a situation which the Government is 
trying to remedy through the Furman Review. 


As detailed earlier, the vague definitions of the Code will mean smaller businesses 
will be unsure whether they are covered and, faced with potentially draconian 
penalties, take precautions which may not be necessary. Notoriously this happened 
on a large scale with GDPR. 


Children, especially 16-17 year olds who are most likely to use online services, are 
very familiar with age restrictions and adept at avoiding them. There is already a 
thriving market in fake ID cards. Children may also be tempted to use VPNs — virtual 
private networks — which disguise the user’s identity. VPNs are widely used in China 
to access censored content. 


Age verification will put adults at risk by obliging them to provide documents such 
as passports and driver’s licences which contain data that can be used by criminals 
to gain access to users’ bank accounts, medical records, and other sensitive 
personal information. 


And there can be no doubt that if age verification becomes widespread bad actors 


will set up enticing-looking websites purely for the purpose of luring the public into 
supplying personal data, in order to use it for fraudulent purposes. 
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Recommendations 
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As far as news websites are concerned the potential outcomes of this Code are 
totally disproportionate to the risks it attempts to address. The Code presents no 
evidence of children being harmed by visiting news websites, or viewing advertising 
on them. Indeed the public would not be aware of the problem of online harms had 
it not been drawn to their attention by news reports. Against that, erecting age 
walls to eliminate this unproven risk will have a catastrophic effect, potentially 
causing the closure of the online news industry. 


Recommendation 1. The remedy is simple — online news websites must be granted 
complete exemption from the Code. Exemption has been given to TV and radio 
broadcasters, which present content and advertising specifically aimed at 
children, and it is very difficult to see why it is not extended to news websites, 
which do neither. 


The Code is structured in a way which gives far greater emphasis to failsafe 
protective measures than to what the ICO regards as practices and content suitable 
for child users. If our analysis of Chapter 5 is correct, and the Code does permit the 
use of cookies to serve CAP-compliant advertising to children it should say so 
clearly. If that is not the case, the Code should be changed so that is the position. If 
that were the case there would be no need for age verification and the catastrophic 
consequences that would follow. 


Recommendation 2. The Committee of Advertising Practice has strict rules for 
advertising aimed at children, enforced rigorously by the Advertising Standards 
Authority. It would be perverse if one regulator, the ICO, were to ban content 
passed as fit for purpose by another regulator, the ASA. The Code should make 
clear that advertising for children which meets CAP rules is permissible, as is the 
use of profiling (cookies) to ensure it reaches the right audience, and that in those 
circumstances age verification is not necessary. 


Recommendation 3. When the Code is redrafted proper consideration must be 
given to European Convention on Human Rights Article 10, and steps taken to 
ensure compliance. The simplest way to ensure this would be to give a total 
exemption to news publishers. 


Peter Wright 
Editor Emeritus 
DMG Media 
May 2019 
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